Key Insights
- Crypto Hack drained nearly $11M from THORChain across four chains.
- RUNE traded near $0.44–$0.48 after falling on news of the exploit.
- The incident renewed concern over cross-chain DeFi security risks.
A major crypto hack hit THORChain on Friday, draining about $10.7 million across Bitcoin, Ethereum, BNB Chain, and Base. The cross-chain liquidity protocol halted trading and signing activities due to suspicious activity.
RUNE price fell sharply after the news, although weekly gains remained partly intact as traders watched the response. The exploit affected THORChain’s core cross-chain swap system, which lets users exchange native assets without wrapped tokens.
The incident renewed concerns about DeFi security, especially across protocols that handle liquidity on several chains. It also placed fresh pressure on RUNE price, which traded near the $0.44 to $0.53 range after the breach.
Blockchain investigator ZachXBT and security firm PeckShield identified two suspected theft addresses linked to the incident. One address held the Bitcoin portion of the stolen funds.
Another address held assets across Ethereum and other EVM-compatible chains.
THORChain Hack Forces Emergency Trading Halt
The THORChain crypto hack prompted validators to activate emergency safeguards through the protocol’s governance controls. THORChain’s Mimir module switched trading halt and signing halt parameters to active.
A node pause also ran from block 26190429 for more than 12 hours. The response stopped swaps while the team investigated the suspected breach.
That move helped contain further damage, but it also confirmed the seriousness of the incident. Traders reacted quickly because THORChain depends on uninterrupted cross-chain liquidity.
Wallet data showed the suspected crypto hack attacker held about 36.85 BTC, valued at nearly $2.97 million. The EVM-linked wallet held thousands of ETH and other assets. Reports placed the total loss near $10.7 million, which rounds to about $11 million for headline purposes.
The THORChain team had not released a full technical post-mortem at the time of the reports. That left traders without a clear explanation of the attack vector.
It also increased pressure on the protocol to explain whether user funds, liquidity pools, or validator processes faced direct exposure.
This comes after other concerns about the financial and operational structure of THORChain. ThorFi’s lending operations were paused in January 2025, as it underwent a restructuring.
That move followed claims tied to defaulted obligations and liquidity pressure.
Crypto Hack Pressures RUNE Price Near Key Support
The crypto hack pushed RUNE lower as investors reassessed near-term risk. RUNE price fell about 10% to 12% after the exploit reports.
The decline followed a break below important short-term levels. THORChain crypto price slipped under its seven-day simple moving average near $0.5998.
It also moved below the 38.2% Fibonacci level near $0.544, which traders often watch after sharp market swings.
Selling pressure increased as volume jumped sharply. Reports showed 24-hour volume climbing more than 160% to around $26.84 million.
That suggested investors were not only reacting to the crypto hack headline but also reducing exposure during the halt.
The next key level sits near $0.50. If RUNE holds that area, traders may watch for a recovery toward $0.544. However, a break below $0.50 could expose the token to lower support near $0.488 and $0.448.
The RUNE price reaction also differed from Bitcoin and Ethereum. Bitcoin gained during the same period, while Ethereum remained nearly flat.
That showed the sell-off focused mainly on THORChain’s protocol risk rather than broader crypto weakness.
Crypto Hack Raises Fresh DeFi Security Questions
The crypto hack added to growing concern over attacks on cross-chain protocols. THORChain allows users to move between native assets across separate blockchains.
That design creates value, but it also requires complex security controls across several environments. Cross-chain bridges and liquidity networks have been among DeFi’s most attacked systems since 2021.
Reports cited more than $2.8 billion in bridge-related thefts over that period. Attackers often target these protocols because they hold large liquidity pools and connect multiple networks.
The THORChain crypto hack also arrived during an active period for DeFi exploits. Other protocols, including Huma Finance and Ink Finance, recently reported smaller losses from contract vulnerabilities.
Those cases showed how attackers continue to exploit logic flaws, permission gaps, and weak validation systems.
The next update of THORChain will matter for both traders and liquidity providers. A clear post-mortem could explain the weakness and outline recovery steps.
A delayed or unclear response may keep pressure on RUNE and slow confidence in the protocol’s cross-chain liquidity model.
Market attention now remains on three points. Traders are watching whether swaps resume safely, whether stolen funds move again, and whether RUNE price defends the $0.50 level.
